Bro hasn't been employed at any natsec-level project to even _try_ to suggest the first option.

C’mon, why don’t you like the authorized secure development workflow? You know, the triple-nested RDP Rube Goldberg machine that connects you to a 15yo desktop environment running on a Pentium III over a dial-up link to the moon (that can only run the IDE that time forgot, most of whose non-obsolete features don’t work because of the eighteen competing antimalware services running).

It’s ATO’d and everything, and it works for all the other contractors. They have no trouble shipping on time, give or take a decade or so; what’s your problem?